ITG27 Targets Indian Energy with Havencode Backdoor

IBM X-Force has identified a sophisticated cyber espionage campaign by ITG27 (also known as Mustang Panda), a China-aligned state-sponsored group targeting India's energy sector and government agencies. This campaign exploits regional geopolitical tensions surrounding hydropower cooperation between India and Nepal, utilizing spear-phishing emails with malicious PDF lures to deliver the Toneshell and Havencode backdoors.

Technically, the actor employs DLL side-loading (T1574.001) to deploy Claimloader, which subsequently executes the Toneshell v10 backdoor using memory-resident shellcode. A significant discovery in this campaign is 'Havencode,' a previously unknown backdoor with hidden Virtual Network Computing (hVNC) capabilities. Havencode allows operators to interactively browse victim desktops, extract credentials, and tunnel traffic via custom proxy protocols.

This activity represents a high risk to critical infrastructure and government entities in South Asia. The group's ability to maintain access for multiple days and conduct manual, hands-on-keyboard operations during standard China working hours (CST) underscores a persistent and disciplined intelligence requirement focused on strategic regional interests.